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ABSTRACT 


Purpose: The purpose of writing this research is to find an analysis of 
the Data Protection bill with reference to the parameters of data protection 
and the right to privacy attached to it. The bill contains lot many aspects of 
creating privacy standards and the legislation related to data protection is 
much needed for an hour. 

Aim: The aim of the study specifically covers the aspects of digital data 
and its protection related to it. The study covers aspects related to bill where- 
in the individual data protection considers to be an important part that cre- 
ates trust between the person and entity/organization handling data. 

Methodology: This study is based on a doctrinal approach and analyzes 
the recent bill and existing laws for the data protection bill. The study specifi- 
cally represents the recent bill of data protection and existing laws related to 
data protection and how the statistics show that there is an increase in digital 
transactions required to share data. 

Outcome: The outcome of this paper suggests that the data protection 
bill incorporates various in the form policies and mechanisms to drive out the 
personal and individual protection of data. The graphical representation in 
this study shows that there is a rapid change in technology wherein digita- 
lization is required to keep the legislation related to data protection. Across 
the world, there are many countries that have a comprehensive regulatory 
framework wherein the expert committee was set under the Chairmanship of 
Justice B N Srikrishna to examine to requirements and issues of data protec- 
tion and its probable solutions. 
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INTRODUCTION 


A new regulatory framework to control the pro- 
tection of personal data is now being adopted in 
India. The Committee of Experts, under the direc- 
tion of Justice B.N. Srikrishna, drafted the draught 
Personal Data Protection Bill, 2018. We observe 
that, notably in relation to processing by private 
entities, the draught Bill provides data subjects 
with a sizable number of data protection prin- 
ciples and rights. But there are a few crucial ar- 
eas where the stances taken by the Bill need to 
be reviewed. This comprises rules governing the 
composition and layout of the Data Protection 
Authority, the function of adjudication officers, 
the flow of data across international borders, and 
the range of legal exceptions, particularly as they 
apply to government organizations. In Article 21 
of the constitution, the right to privacy is recog- 
nized as a derived or implied fundamental right. 
The court stressed the necessity of enacting strict 
rules regarding data protection and privacy when 
it announced its decision on the Privacy Judge- 
ment. Indeed, there was a pressing need for sucha 
law to protect the personal information of Indian 
data subjects because their privacy was in danger 
due to the crucial role that data played in the de- 
velopment of the digital economy. 


KEY SUGGESTIVE AREAS OF THE 
BILL FOR REVISITING 


Firstly, reviewing the regulations controlling 
cross-border data transfer is necessary, especial- 
ly in light of their overbroad nature, the minimal 
privacy improvements it would provide, and the 
potential repercussions on freedom of speech 
and other rights. Second, the scope of exemptions 
granted to government agencies for security and 
law enforcement purposes needs to be reviewed 
in order to bring the provisions into compliance 
with the Supreme Court's decisions in Puttaswamy 
v. Union of India and ensure an adequate balance 
between the rights to individual privacy and the 
needs of state security. Thirdly, it has analyzed the 
jurisprudential development and current status of 
the law of privacy in India as well as the numerous 
model privacy laws that have been created over 


time. The State was primarily the source of privacy 
worries in the beginning. Fourthly, aside from the 
exemptions listed in Chapter IX of the Bill, a num- 
ber of points need to be reviewed. A more accept- 
able balancing of privacy with competing rights, 
such as the freedom of expression and the right to 
employment, will be achieved through introducing 
categories like academic and creative activity and 
nuanced changes to the scope of current exemp- 
tions. 


MULTI DIMENSIONALITY OF 
RIGHT TO PRIVACY VIS-A-VIS 
DATA PROTECTION BILL, 2018 


The concept of a person's right to privacy is 
complex. An individual's special right to manage 
the gathering, use, and disclosure of his personal 
information is referred to in the context of person- 
al data. Personal information includes things like 
a person's name, address, phone number, email 
address, likes and dislikes, daily routine, family 
history, education, communication, health, and fi- 
nances, among other things. We now live ina time 
where individuals' personal information can be 
creatively exploited for a variety of reasons, such 
as government surveillance and commercial rev- 
enue generation. The fact that certain methods, 
such as clustering, geotagging, and geocoding, 
allow for the unauthorized use of a person's per- 
sonal data is noteworthy. Other companies may be 
able to contact the person who shared the photo 
and give him unwanted adverts, leading to a pos- 
sible sale. This should highlight the fact that 'data' 
has the capacity to both empower and hurt, as well 
as to reveal its salient implications. Innovations in 
technology have made it possible to communicate 
and access. 

The fact that "data" may empower people as 
well as cause them damage. Innovative technolo- 
gies undoubtedly make personal data more acces- 
sible and transferable. As a result, it is crucial to 
create a strong and efficient data protection pol- 
icy that will strike a balance between innovation 
and privacy protection. Therefore, resolving all the 
competing interests in information should be the 
main goal of a successful data protection law. 
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PROMINENT FEATURES 
OF TRE BILL 


It is better to evaluate the proposed Bill in the 
context of the European Union General Data Pro- 
tection Law since the latter has emerged as the 
initiative leading data protection efforts while the 
former is still in the executive branch. The research 
will include two distinct narratives: the anatomical, 
or exclusive rights, examination of fundamental 
label and provision; and the skimming orientation 
of the ruling class. The Committee stressed the im- 
portance of striking a balance between privacy and 
speech when determining whether the right to be 
forgotten is appropriate. Instead of the right to be 
forgotten, this matter should have been addressed 
under "the lawfulness of the processing." When it 
is determined that the data principal's disclosure 
of the information is solely personal in nature and 
unrelated to the public interest, there is a greater 
balance of expediency for the data theme than for 
the fiduciary. 


CONSTITUTIONALITY ON RIGHT 
TO PRIVACY IN INDIA VIS-A- 
VIS SHORTCOMING OF DATA 
PROTECTION BILL, 2018 


The right to privacy is not stated expressly in 
the Indian Constitution. While taking into account 
various cases of government interference with 
personal privacy, Indian courts had taken the ar- 
gument that the right to privacy is a basic right 
into consideration. The Personal Data Protection 
Bill, 2019, is the latest in a long line of privacy laws 
in India that have been impacted by both national 
and international trends. A right to privacy exists 
even though it is not expressly stated in the con- 
stitution, according to Indian courts, because Arti- 
cle 21's guarantee of the right to life also includes 
a right to privacy. 

In Kharak Singh v. State of Uttar Pradesh’, K. 
Subbarao and K.C. Shah, JJ., delivered a minority/ 
dissenting judgement of the Supreme Court and 


i Govind v. State of Madhya Pradesh AIR 1975 SC 1378; R. 
Rajagopal v. State of Tamil Nadu AIR 1995 SC 264; PUCL v. 
Union of India AIR 1991 SC 207. State of Maharashtra v. 
Madhukar Narayan Mardikar AIR 1999 SC 495 

2 1964 SCR (1) 332. 


recognised the right to privacy as a fundamental 
right protected by Articles 21 and 19(1)(d) of the In- 
dian Constitution. This is another significant ruling 
worth mentioning. The U.P. Police Regulations’ dai- 
ly surveillance rules were being examined by the 
Court in this case. Following a dacoity accusation, 
the petitioner was found not guilty. According to 
the majority decision in the case, there is no con- 
stitutionally protected right to privacy. Two caus- 
es that grew more important made it necessary to 
clarify this ambiguity: (1) vociferous complaints of 
loss of privacy following the government's adop- 
tion of its initiative for unique biometric identity; 
and (2) concurrent worldwide developments. 
Another judgment where the right to privacy 
will bring out an edging outcome is that in this 
case®, CBI requested access to the Unique Iden- 
tity Authority of India's database in this instance 
in order to look into a criminal offense. According 
to a temporary ruling from the Supreme Court, the 
Unique Identity Authority of India is not allowed 
to give any other agency any biometric data about 
a person who has been given an Aadhaar number 
without that person's express written permission. 
The K.S. Puttaswamy v. Union of India’ case, 
where the Unique Identity Scheme was considered 
in relation to the privacy problem, was decided, was 
significant. Given that there is no explicit privacy 
provision in the Indian Constitution, the Court was 
asked if the right to privacy is guaranteed by the 
Constitution and, if so, what constitutes the source 
of such right. Privacy is not a fundamental right, ac- 
cording to India's attorney general. In the end, the 
Court deferred to a bigger Constitutional Bench to 
consider the issue because past rulings that reject- 
ed the right to privacy were rendered by benches 
larger thn those that determined instances where 
the right was acknowledged as a fundamental right. 
A number of challenges challenging the le- 
gality of the legislation enabling the system, the 
Aadhaar (Targeted Delivery of Financial and Other 
Subsidies, Benefits and Services) Act of 2016, were 
filed before the Supreme Court as a result of pri- 
vacy concerns regarding Aadhaar. The five-judge 
bench of the Supreme Court that examined the pe- 
titions stated that it was crucial to first establish if 


3 Unique Identification Authority of India v. Central Bureau 
of Investigation (2017) 7 SCC 157 
4 (2017) 10 SCC 1) 
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the right to privacy was recognised by the consti- 
tution because the petitions alleged infringement 
of that right. It sent this matter to a bench of nine 
Supreme Court Justices, who then determined that 
privacy was a part of this right to privacy under 
Article 21 and that the Supreme Court had erred in 
its Kharak Singh decision. 


CHALLENGES OF DATA 
PROTECTION IN AN EPOCH OF 
BIG DATA 


Big data and data are now a new source of 
enormous economic and social values as well as 
the basic building blocks of manufacturing. Busi- 
nesses, governments, and individuals now have ac- 
cess to a much wider range of information thanks 
to developments in data mining and analytics as 
well as a dramatic rise in processing power and 
data storage capacity. Scientists have had to coin 
new terminology, such as zettabyte and yottabyte, 
to depict the flood of data due to the rapid growth 
of the amount of data being generated and stored 
worldwide. According to Andeson and Raini, when 
determining whether the right to be forgotten was 
appropriate, the Committee placed a strong em- 
phasis on striking a balance between the right to 
privacy and the freedom of speech. 


Year wise Distribution of Transaction Month wise Distribution of Transaction 


2013 0.56% 
2017 7.16% 


500,000 


2022 24.02% 


2018 9.89% 


2019 12.31% 


2021 24.22% 
~ 2020 16.71% 


A number of fundamental principles serve as 
the foundation for international data protection 
measures like the OECD Guidelines, European 
Directive, APEC Privacy Framework, and nation- 
al data protection laws around the world. Re- 
strictions on further use include | ensuring that 
personal data isn't processed excessively or for 
purposes other than those for which it was orig- 
inally collected (generally, personal data cannot 
be used for other purposes without the consent 
of the individuals), (ii) providing individuals with 
information about any personal data process- 
ing, and (iii) ensuring that personal data is only 
used for legitimate purposes. 


WHETHER GDPR-STYLE DATA 
PROTECTION LAW WORK FOR 
INDIA? 


India currently lacks a cross-sectoral data pro- 
tection law, despite the EU having recognised a 
right to the protection of personal data for some 
time (under the Treaty on the Functioning of the 
European Union). Although it has some rules re- 
garding the protection of personal data, the Infor- 
mation Technology Act of 2000 largely regulates 
matters like cybercrime and the accountability of 
internet intermediaries, such as social media plat- 
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forms. For instance, the act's section 43A offers 
compensation for harms brought on by a failure 
to uphold appropriate security procedures to safe- 
guard sensitive personal data. But only a hodge- 
podge of sector-specific legislative standards 
governs the requirements for data protection and 
confidentiality. 

The EU IA stated that harmonising privacy 
standards would be one of the primary economic 
benefits of implementing the GDPR in the EU. It is 
important to consider what economic advantages 
the proposed bill would bring to India given that it 
does not have the issues associated with an out- 
dated, disjointed legislative structure for data pro- 
tection. The patchwork of existing privacy-related 
central regulations in India was passed by the 
federal parliament and is consequently uniform 
throughout the country. As a result, if one were 
to analyse the GDPR's three key advantages for 
the EU in reference to India, at least one of them 
would not be immediately applicable. 


DEVELOPMENT OF PERSONAL 
DATA PROTECTION IN INDIA 


Data can be used for good, but the arbitrary 
and unchecked use of data, particularly personal 
data, has sparked worries about an individual's 
liberty and privacy. This was also the topic of the 
Supreme Court's historic decision, which recog- 
nised the right to privacy as a basic human right. A 
Committee of Experts has been formed by the In- 
dian government to examine various data protec- 
tion-related concerns and make recommendations 
for a draught data protection law. The purpose is 
to "promote the expansion of the digital econo- 
my while maintaining citizen privacy and personal 
data security and protection. 

The distribution of online transactions clearly 
shows that it is increasing every year and to make it 
secure a data protection bill is required. The distri- 
bution curve clearly shows that the digital transac- 
tion significantly increases with time due to which 
there is a requirement of creating a comprehensive 
framework. The imminent data protection rule will 
broaden the scope by providing a thorough data 
protection outline that shall apply to the dispen- 
sation of personal data by any method and to pro- 


cessing activities carried out by both the govern- 
ment and the sequestered entities—not just body 
corporate-instead of just body corporate. 


IMPLICATION OF DATA 
PROTECTION LAW IN INDIA 


Information has become the only resource 
people rely on in the modern world. With the help 
of social internet platforms like Facebook, Skype, 
Whatsapp, and others, society is now intercon- 
nected through a single informational thread. 
These social media platforms have become so im- 
portant to people nowadays that they are used as 
a conduit for sharing every last detail of their lives. 
People from all over the world now communicate 
with one another on these social media platforms, 
creating a new dimension of the world. Therefore, 
through developing effective legislation, it is cru- 
cial to secure data from being misused by people 
or the government. 

Social media is a form of Internet-based com- 
munication. In addition, there are numerous ad- 
ditional forms of social media, such as blogs, mi- 
croblogs, wikis, webpages, widgets, and virtual 
worlds. The popularity of social networking ser- 
vices like Facebook, Twitter, WhatsApp, and others 
has increased significantly in recent years. To use 
a social media site, however, and to find other ac- 
counts, the person needs first to create a database. 

Digitization is a term used to describe the pro- 
cess of creating a numerical sequence that de- 
scribes a distinct set of an item, image, sound, 
document, or signal points. The third industrial 
revolution, known as the digital economy, is anew 
productivity platform that has emerged globally. 
It is also known as The Internet Economy or The 
Internet of Everything (loE), and it is predicted to 
create new job prospects, market growth oppor- 
tunities, and the largest commercial opportuni- 
ty in human history. It is interesting how quickly 
our technological advancement has accelerated 
thanks to Digital India. The goal of the Digital In- 
dia Program is to make India a hub of global con- 
nectivity. 
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CONCLUSIONS & SUGGESTION 


A person's or group's right to privacy refers to 
their capacity to conceal or separate information 
about themselves in particular. Although the defi- 
nition of what is personal and its content differ 
between cultures and people, they all have some 
common ground. Privacy is occasionally associat- 
ed with namelessness, the desire to go unnoticed 
Or anonymous in the public sphere. When some- 
thing is personal to a person, it typically means 
that they perceive it as exceptional or delicate in 
some way. The extent to which private information 
is revealed in this way will vary depending on how 
it is gathered in the open, contrasting between lo- 
cations, and over time. 
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